Italy National Cyber Security Perimeter: PSNC and Law 90/2024 duties

Italy runs a national security cyber regime that sits alongside NIS2 and is stricter than it: organisations inside the Perimetro di sicurezza nazionale cibernetica (PSNC) report some incidents within one hour, keep certain data in Italy and must clear key ICT purchases with a national evaluation centre. A second law, Law 28 June 2024 n. 90, added a 24 and 72 hour incident reporting duty for many public bodies and their in-house companies, plus heavier cybercrime penalties. This guide explains who each regime covers, the obligations and deadlines, sanctions, how they interact with NIS2 and what security and identity teams need to evidence. It is for CISOs, compliance leads and suppliers of ICT to Italian public bodies and strategic operators. The NIS2 layer is covered in the Italy NIS2 Implementation Guide; this page covers what that one does not.

Source note, checked 9 November 2026: the Agenzia per la cybersicurezza nazionale (ACN) perimeter pages could not be accessed, so the PSNC sections of this guide are based on secondary sources: a Cleary Gottlieb memo on the completed PSNC framework (2023), ICT Security Magazine's comparison of the PSNC and NIS2, and Cybersecurity360. Penalty figures and deadlines are included only where two of these sources agree. Article 1 of Law 90/2024 was read in its consolidated text on Normattiva, and its publication details on the Gazzetta Ufficiale. Confirm against the official text before relying on it.

Key takeaways

• The PSNC is a closed list: inclusion is by a non-public Prime Minister's act, and ACN notifies each included entity, so you know if you are in.
• Clocks are short: incidents on perimeter ICT assets go to CSIRT Italia within one hour or six hours depending on their category in Annex A to DPCM 81/2021.
• Procurement needs clearance: certain ICT goods and services for perimeter assets must be notified to the Centro di valutazione e certificazione nazionale (CVCN) before purchase, with a 45 day review and up to 60 days of testing.
• Law 90/2024 reaches the wider public sector: central administrations, regions, large municipalities, health authorities and their in-house companies report within 24 hours and notify fully within 72 hours, with fines for repeated failures.
• NIS2 carves perimeter assets out: according to ICT Security Magazine, systems on the PSNC asset list fall outside the Italian NIS2 decree, while the same entity's other systems fall under it.

The legal framework

The perimeter was created by Decree-Law 21 September 2019 n. 105, converted with amendments by Law 18 November 2019 n. 133. It is built out by a series of implementing acts, and ACN, created by Decree-Law 82/2021, now runs it, including the CVCN.

ICT Security Magazine reports that ACN's annual report gives a count of included entities and that DPCM 111/2025 replaced one of the Annex A incident tables, adding a category for unauthorised or privileged access abuse. Neither point could be confirmed in a second source, so check both with ACN.

Who is in scope

The PSNC covers national public and private bodies that perform an essential function of the State or provide a service essential to civil, social or economic activity, where malfunction or misuse of their networks, information systems and IT services could harm national security. The assets in scope are the "beni ICT" each entity lists. The list of included entities is not published.

Law 90/2024 Article 1 is broader and public: central public administrations, regions, the autonomous provinces of Trento and Bolzano, metropolitan cities, municipalities above 100,000 inhabitants or regional capitals, certain urban and extra-urban public transport companies, local health authorities and the in-house companies that provide IT, transport, water or waste services to them. Article 1 paragraph 7 excludes PSNC subjects (which follow their own rules), certain entities under the old NIS decree, and law enforcement, defence and intelligence bodies.

PSNC obligations and deadlines

Sanctions: both Cleary Gottlieb and ICT Security Magazine report administrative fines under Article 1 of DL 105/2019 of 200,000 to 1,200,000 euro for failing to send or update the asset list, 250,000 to 1,500,000 euro for failing to notify an incident or apply the security measures, and 300,000 to 1,800,000 euro for using ICT in breach of CVCN conditions or without passing its tests.

Incident notification

Annex A to DPCM 81/2021 splits incidents into two tables, one with a one hour deadline for the more serious categories and one with six hours. The notification duty also covers systems that share security functions, compute or memory resources or base software with a listed asset, according to ICT Security Magazine. After recovery the entity must inform CSIRT Italia and, on request, produce a technical report within 30 days, according to both Cleary Gottlieb and ICT Security Magazine. Because the clock runs from awareness, the hard part is internal: detection, triage and an on-call decision maker who can classify against Annex A at night.

Data location

According to Cleary Gottlieb's summary of the Category B measures, data processed through or describing ICT assets must be stored and processed on infrastructure in Italy, security and disaster recovery data may move elsewhere in the EU only with legal or technical justification, and encrypted backups may sit in the EU outside Italy only if the keys stay in Italy. This has direct consequences for cloud and SaaS choices; see the Data Sovereignty and Residency Guide.

CVCN procurement clearance

Before buying ICT goods, systems or services in the DPCM 15 June 2021 categories for use on perimeter assets, the entity notifies the CVCN with a risk analysis of the supply. The CVCN may impose conditions and order tests, including intrusion tests, carried out at accredited laboratories, and suppliers bear the evaluation and testing costs, according to Cleary Gottlieb. ICT Security Magazine reports that silence after each deadline allows the procurement, then the contract, to proceed. Suppliers should expect to provide architecture and security function documentation and a test environment.

Law 90/2024 obligations

• Incident reporting (Art. 1): incidents in ACN's taxonomy affecting networks, information systems and IT services are reported within 24 hours of awareness and fully notified within 72 hours. For municipalities, transport companies, health authorities and in-house companies the duty applied only after a deferral period set in the law, according to Cleary Gottlieb and ICT Security Magazine; the sources do not agree on the exact date, so check Article 1 in the official text.
• Warnings, inspections and fines (Art. 1 paragraphs 5 and 6): after a late or missed notification ACN warns the entity and may inspect within 12 months; a repeat within five years brings a fine of 25,000 to 125,000 euro, and officials may face disciplinary and administrative-accounting liability.
• Cyber security structure and referente: covered entities set up a cyber security structure, which may sit within the digital transition office, and appoint a referente per la cybersicurezza with relevant competence, whose name is communicated to ACN (Cleary Gottlieb and ICT Security Magazine).
• Vulnerability remediation: ACN may notify covered entities of specific vulnerabilities, and they must apply the remedies it indicates within a short statutory deadline unless technical or organisational reasons justify delay. Check the exact deadline and fine in Article 2 of the official text.
• Procurement: public bodies, public service operators, publicly controlled companies and PSNC entities must apply essential cyber security elements, set by a later implementing DPCM, according to Cleary Gottlieb, when procuring specified ICT for strategic contexts. Confirm with ACN whether and when that decree was adopted.
• Cybercrime and corporate liability: the law raised penalties for offences such as unauthorised access (Art. 615-ter of the Criminal Code), created a cyber extortion offence and increased corporate fines under Article 24-bis of Legislative Decree 231/2001, according to Cleary Gottlieb.

How PSNC, Law 90/2024 and NIS2 interact

An Italian organisation can sit under one, two or all three regimes, split by system rather than by entity. According to ICT Security Magazine's reading of Legislative Decree 138/2024, Article 33 requires PSNC risk management and notification obligations to be at least equivalent to NIS2, systems on the PSNC asset list are outside the NIS2 decree, and incidents already notified under PSNC rules do not need a separate NIS2 notification. The same source reports that Article 43 changed the PSNC's earlier rule for incidents on non-perimeter systems, so older guidance quoting a 72 hour PSNC clock for those systems may be outdated.

Where an incident spans perimeter and non-perimeter systems, ICT Security Magazine suggests applying the shorter PSNC clock and assessing a NIS2 notification in parallel, while flagging that this is an open question. Agree the approach with legal counsel in advance. See the Cyber Incident Reporting Requirements Map for other jurisdictions.

Where identity fits

None of these texts mention non-human identities, but the evidence they demand depends on them. NHI Mgmt Group recommends:

• List machine identities with the assets: service accounts, API keys, certificates and workload identities that administer or connect perimeter assets belong in the asset documentation, because a stolen key is a route to the asset.
• Keep keys where the data must stay: if encrypted backups leave Italy, the keys and the identities that can use them must not. Check key management and HSM locations.
• Classify credential incidents fast: privileged access abuse is an incident category to plan for; prepare detection that tells you within minutes whether a privileged or machine credential touched a listed asset. See the Non-Human Identity (NHI) Guide.
• Include supplier access in CVCN risk analysis: remote support accounts and integration tokens are part of the supply risk the CVCN notice must describe.

Compliance steps

1. Confirm your status: check for an ACN inclusion notice (PSNC), the Law 90/2024 Article 1 lists and your NIS2 registration, and record which regime applies to which system.
2. Segment the estate: mark listed perimeter assets and anything sharing security functions, compute or base software with them, since notification extends to those.
3. Build a one hour playbook: map Annex A categories to detection rules, name 24/7 decision makers, and rehearse a night-time notification to CSIRT Italia.
4. Check data and key location: inventory where perimeter data, DR copies, backups and encryption keys sit, and plan moves before contract renewals.
5. Embed CVCN in procurement: add a gate to sourcing so in-scope ICT categories are notified before tender, and add supplier testing cooperation to contract templates.
6. Appoint the Law 90/2024 referente: where applicable, give the role authority to report and a deputy for cover.
7. Run a tabletop across regimes: one incident touching perimeter and non-perimeter systems, to test who notifies whom and when.

Framework mapping

Detection and measurement

• Time to classify: minutes from alert to Annex A classification for incidents on perimeter assets.
• Notification timeliness: share of notifications sent inside the one hour, six hour, 24 hour and 72 hour clocks.
• Asset list currency: days since the last asset list update and changes not yet reflected.
• Procurement gate coverage: in-scope purchases notified to the CVCN before tender, as a share of all in-scope purchases.
• Vulnerability notice closure: time to apply ACN-indicated remedies against the statutory deadline.

Common failure patterns

• Treating NIS2 compliance as enough: NIS2 clocks are longer, and perimeter assets are outside the NIS2 decree, so a NIS2 playbook alone misses the one hour duty.
• Asset lists without dependencies: shared identity, logging or hypervisor platforms are left off, so incidents on them are not recognised as notifiable.
• Keys abroad: backups are encrypted and moved within the EU, but the key management service and its admin identities sit outside Italy.
• Procurement surprises: a contract is signed before the CVCN notice because sourcing did not know the category was in scope.
• Relying on outdated FAQs: older guidance on the 72 hour PSNC rule for non-perimeter systems no longer reflects the post-NIS2 position, according to ICT Security Magazine.

Practitioner checklist

• Record which systems fall under PSNC, Law 90/2024 and NIS2.
• Keep the PSNC asset list current, including shared platforms and machine identities.
• Map Annex A categories to detection rules and a 24/7 notification rota.
• Verify data, backup and encryption key locations against the Category B measures.
• Add a CVCN gate to procurement and supplier contracts.
• Appoint the Law 90/2024 referente and structure where applicable.
• Track ACN vulnerability notices to closure inside the statutory deadline.
• Rehearse a cross-regime incident once a year.

Standards and references

• Normattiva: Law 28 June 2024 n. 90, consolidated text
• Gazzetta Ufficiale: Law 28 June 2024 n. 90
• Cleary Gottlieb: Italian National Cybersecurity Perimeter after completion of the framework
• Cleary Gottlieb: Entry into force of the Cybersecurity Law
• ICT Security Magazine: PSNC and NIS2 differences
• ICT Security Magazine: Law 90/2024 and security testing
• Cybersecurity360: PSNC, how it works and who is in it

Related NHI Mgmt Group resources: Italy NIS2 Implementation Guide · Cyber Incident Reporting Requirements Map · Data Sovereignty and Residency Guide · Non-Human Identity (NHI) Guide. This guide summarises Italy's National Cyber Security Perimeter and Law 90/2024 as they stood on 9 November 2026 and is not legal advice.